Loading vulnerability…
Out-of-bounds write in Apple iOS, iPadOS, visionOS, and watchOS
CVE-2026-65385 is an out-of-bounds write vulnerability affecting Apple iOS, iPadOS, visionOS, and watchOS. Insufficient bounds checking permits a buffer overflow that may corrupt memory and cause unexpected application termination. The affected component and vulnerable function are not specified. Apple addressed the issue through improved bounds checking.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may cause memory corruption and unexpected application termination, resulting in application-level denial of service. Arbitrary code execution, privilege escalation, and information disclosure are not established for this vulnerability.
If you can’t patch tonight, do this now.
No temporary mitigation or workaround is specified.
Patch, then assume compromise.
Update to iOS 26.7.2 or 27.2, iPadOS 26.7.2 or 27.2, visionOS 27.2, or watchOS 27.2, as applicable. These releases include improved bounds checking to address the out-of-bounds write.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.